api: fix handling of errors in the authTokenMiddleware